Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%
Buy Us a Coffee

Apache Druid — Vulnerabilities & Security Advisories 12

All 12 CVE vulnerabilities found in Apache Druid, with AI-generated Chinese analysis, references, and POCs.

Vendor: Apache

CVE IDTitleCVSSSeverityPublished
CVE-2026-23906 Apache Druid: Authentication Bypass via LDAP Anonymous Bind CWE-287 9.8AICriticalAI2026-02-10
CVE-2025-59390 Apache Druid: Kerberos authenticaton chooses a cryptographically unsecure secret if not configured explicitly. CWE-338 9.8AICriticalAI2025-11-26
CVE-2025-27888 Apache Druid: Server-Side Request Forgery and Cross-Site Scripting CWE-918 5.4 -2025-03-20
CVE-2024-45537 Apache Druid: Users can provide MySQL JDBC properties not on allow list CWE-20 6.5 -2024-09-17
CVE-2024-45384 Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack 7.5 -2024-09-17
CVE-2022-28889 Clickjacking in the web console CWE-1021 4.3 -2022-07-07
CVE-2021-44791 Reflected XSS on certain HTTP endpoints CWE-79 6.1 -2022-07-07
CVE-2021-36749 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended (incomplete fix of CVE-2021-26920) 6.5 -2021-09-24
CVE-2021-26920 Apache Druid: The HTTP inputSource allows authenticated users to read data from other sources than intended 6.5 -2021-07-02
CVE-2021-26919 Apache Druid Authenticated users can execute arbitrary code from malicious MySQL database systems. 8.8 -2021-03-30
CVE-2021-25646 Authenticated users can override system configurations in their requests which allows them to execute arbitrary code. 8.8 -2021-01-29
CVE-2020-1958 Apache Druid 注入漏洞 6.5 -2020-04-01

All 12 known CVE vulnerabilities affecting Apache Druid with full Chinese analysis, references, and POCs where available.